Analysis

Email & DNS

Mail routing, filtering gateways and DMARC posture reveal more about a school's IT maturity than its website does — and here the picture is uneven.

Microsoft runs the mailrooms

Microsoft 365 is the near-universal mail platform. Nine of the domains route mail into Microsoft — sometimes directly (Lancaster, Surrey, Aston, U-Maths), sometimes behind a security gateway. Two schools instead use Google Workspace: Liverpool and (pre-opening) Durham. King's is the odd one out with no independent mail domain at all — its school addresses live on King's College London's central estate.

Two email-security gateways recur. Barracuda's Email Security Service filters mail for Cambridge, Leeds and 1729 (and Lancaster reports to Barracuda too); an older UK filtering service, MailAnyone / mx25.net, front-ends Exeter and Imperial. These gateways sit in front of the actual mailbox provider and scan inbound mail.

The DMARC scorecard

DMARC tells the world what to do with mail that fails authentication — i.e. mail that spoofs the school's domain. It's a plain read of security hygiene, and the network splits three ways.

SchoolDMARC policyMail provider / gateway
Lancaster (LUSoM)p=rejectMicrosoft 365
Durhamp=rejectGoogle Workspace
1729p=rejectMicrosoft 365 + Google / Barracuda Email Security Service
Imperialp=quarantineMicrosoft 365 / MailAnyone
U-Mathsp=quarantineMicrosoft 365
Exeterp=noneMailAnyone / mx25.net / MailAnyone
Liverpoolp=noneGoogle Workspace
Cambridgep=noneMicrosoft 365 / Barracuda Email Security Service
Surreyp=noneMicrosoft 365
Leeds (LMaS)no DMARCMicrosoft 365 + Google / Barracuda Email Security Service
Astonno DMARCMicrosoft 365
KCLn/aKing's College London (central)
Nottinghamn/aNone configured
Only three enforce, and one uses a government service

Just Lancaster, Durham and 1729 publish an enforcing p=reject. Two more quarantine. The rest publish a monitor-only p=none or no DMARC record at all — meaning a spoofed "from the school" email would sail through. Notably, U-Maths reports its DMARC data into the NCSC's free Mail Check service (dmarc.service.gov.uk), the UK government's email-security tool — a nice touch even at only quarantine strength.

Who holds the domains

The six .ac.uk domains are all registered through Jisc (the academic-network registry) — though the agent varies: Lancaster manages its own, Leeds's is handled by the indie host Mythic Beasts, the rest via Jisc directly. The commercial domains scatter across GoDaddy (Surrey, Nottingham), 123-Reg (King's, Durham), IONOS (Cambridge), Netistrar (Liverpool) and UK2 (1729). For DNS hosting, GoDaddy's domaincontrol.com nameservers are the most common, with Jisc, Cloudflare, Krystal, IONOS and Lancaster University's own servers also in the mix.

One small tell of longevity: Liverpool registered its .org for a full twelve years, out to 2032 — unusually far ahead for a school.

Next: Privacy & processors →